Original report submitted to the Minister of National Revenue November 2022.

Communication was the Key: CRA’s response to the recommendations made in the Taxpayers’ Ombudsperson’s 2021-2022 Report on MyAccount lockout.

Recommendation #1

The Taxpayers Ombudsperson recommends the CRA conduct a formal review of its processes to ensure it has a flexible plan that provides for a coordinated effort to proactively inform Canadians, in a timely manner, namely on Canada.ca, through social and traditional media, and email about issues that could affect them.

CRA’s response

The CRA agrees with this recommendation.

The CRA has an Account Manager Model in place, which relies on branches across the Agency to appropriately advise the Public Affairs Branch on issues. This model involved development with an external contractor.

The Account Manager Model (see Appendix A) provides partner branches with coordinated access to Public Affairs Branch (PAB) services when launching a major new project or initiative. PAB Account Managers bring together centres of expertise within the Branch to formulate sound and relevant advice and strategies, and to create and implement high quality products and services.

Additionally, the CRA has an extensive planned and unplanned outage communication plan. This includes details about appropriate communications action/tactics, depending on the varying level of severity of the outage. Following an issue, centres of expertise from different areas of PAB host a “post-mortem” to discuss what went well and what could have been improved, and the outage plan is updated accordingly. This process, including the CRA’s preparedness and response time, continues to improve with each issue that occurs.

After the account lockout in February 2021, the Account Manager model was followed by the program branch for the revocation of user IDs and passwords in March 2021. As the Account Manager Model was followed, PAB provided upfront advice and communications to affected Canadians, which resulted in the roll out to be clear, crisp and coordinated. The Account Manager Model has been successfully implemented for several credential revocations since February 2021.

CRA program branches contact their respective Account Manager at the beginning of the planning process and a coordinated effort is taken to prepare appropriate communications, and to brief senior management and other stakeholders, ahead of the credential revocation.

Recommendation #2

The Taxpayers Ombudsperson recommends the CRA create an update schedule for its contextual alerts to ensure the information that it is still providing is helpful and up to date.

CRA's response

The CRA agrees with this recommendation.

Contextual alerts are placed on Canada.ca webpages based on operational requirements or issues that arise. The contextual alerts are reviewed and updated on a case-by-case basis.

PAB webpage owners regularly review the content on the webpages for which they are responsible, including adding or removing contextual alerts. Contextual alerts are updated when the program branch contacts the Account Manager through the Account Manager Model, who then advises on the appropriate communications tactics, including updating contextual alerts. The purpose of alerts can vary, and may include promoting new or enhanced services, highlighting important information, and/or updating and communicating outages or issues.

One existing challenge is that taxpayers’ level of engagement with digital services can vary from monthly sign-ins to once a year. As a result, alerts often need to remain visible longer to ensure all taxpayers have access to the information when they sign in. Alerts for issues are always prioritized, and other alerts are often temporarily hidden to emphasize messaging for ongoing issues. Alerts for issues are also presented in red to ensure they stand out. Alerts are generally changed following system releases when new services or changes are introduced to online services.

One example of multiple contextual alerts in multiple colours appears on the My Business Account webpage. This webpage also includes a contextual alert for revoked credentials.

The CRA has a contextual alert placed on relevant webpages to inform Canadians that some taxpayers may have received a notification that their CRA user ID and password have been revoked. A link to a webpage with more information is also included in the alert.

Recommendation #3

The Taxpayers Ombudsperson recommends the CRA ensure that it always provides a link for more information to the Government of Canada’s web presence, such as Canada.ca, from its social media posts.

CRA’s response

The CRA agrees with this recommendation.

The CRA already follows this best practice and requirement under the Directive on the Management of Communications.

Evidence of this best practice can be found on the CRA’s social media accounts.

• X (English)
• X (French)
• Facebook (English)
• Facebook (French)
• LinkedIn (Bilingual)

Recommendation #4

The Taxpayers Ombudsperson recommends the CRA make the information it provides to Canadian media outlets available to Canadians at the same time, for example, through Canada.ca.

CRA’s response

The CRA agrees with this recommendation.

Providing information to media outlets is one of many ways the CRA communicates issues that affect Canadians. The CRA also communicates to Canadians directly, publishes information on Canada.ca, posts on social media, etc.

When the CRA undertakes an initiative or issue and needs to communicate to Canadians in a timely manner, the CRA uses a number of mediums, including traditional media. The mediums used to communicate to Canadians may vary based on the issue or initiative that needs to be communicated, and the target audience we are trying to reach. Messaging used to reach media often has a different tone than messaging we use to communicate directly with taxpayers.

While the CRA endeavours to have the same information (or reasonable variation) available on all mediums/platforms at the same time, there are instances in which certain mediums are prioritized. For example, the CRA may prioritize responding to the media first, given the potential for broader reach than a Canada.ca webpage. Additionally, for issues in which the CRA does not have all the information immediately, media outlets may be prioritized as they allow us to provide updates to their readership in real-time – meaning the CRA can provide piecemeal information as more details become available. Canada.ca is designed and functions differently, and doesn’t allow updates to be made at the same pace as with media. However, the same information (or reasonable variation) that was provided to the media can be posted on the Canada.ca website within 24 hours.

When the CRA revoked user IDs and passwords in March 2021, the CRA communicated to Canadians in a number of ways, including Canada.ca, the media, social media, and directly to impacted individuals.

Recommendation #5

The Taxpayers Ombudsperson recommends the CRA ensure that it has an issue management plan that is adaptable so it can efficiently communicate with Canadians when there is an emerging issue.

CRA’s response

The CRA agrees with this recommendation.

The CRA has an Issues Management Directive that is an overarching policy, and while it does not describe specific processes, it does outline roles and responsibilities for the Issues Management community and senior management at CRA. The CRA’s Issues Management Directive states “As soon as an issue is identified, a proactive (when possible), coordinated approach is required to ensure that it is quickly analyzed, reported, and addressed.”

With respect to the MyAccount Lockout situation, while an internal and unforeseen technical issue resulted in premature communications to taxpayers, as soon as the Agency’s issues management and public affairs teams were notified of the error, within only 24 hours CRA took an immediate and coordinated approach to ensure that the issue was investigated, reported and resolved.

Current procedures for revoking access/credentials now includes a strategic communications approach (e.g., web content, reactive messaging, email notifications, social media / public outreach). In addition, corporate planning documents, calendars and weekly briefing with Branch heads at CRA now include oversight of planned outage and credential revocation dates in order to ensure that the Agency is prepared, and able to proactively respond to the “known unknowns”.

Issues management plans and / or approaches may be developed and tailored for circumstances with the possibility of significant negative impact on the Agency’s security, operations or reputation. To effectively and quickly address each issue, the CRA must be adaptable and, as a result, may not follow the same process for every single issue. In some instances, developing a formal issues management plan may not be feasible as it could delay getting crucial information to Canadians.

Issues Management plans and / or approaches are leveraged in the event of a major incident involving or implicating the CRA, requiring a coordinated response from some or several CRA Branch heads.

In addition to the Issues Management Directive, the CRA has policies and committees in place to address and guide the Agency and the Issues Management Network through an emerging or ongoing crisis and/or issue, including:

• Issues Management Directive
• Business Continuity Plan
• Crisis Management Readiness framework
• Quick Response protocol, supported by communications
• Agency Operations Centre
• Incident Management Committee

The CRA successfully leveraged our risk and crisis management infrastructure and mechanisms to address COVID-19 and other events faced in 2020.

Appendix A: Public Affairs Branch Account Manager Model

Public Affairs Branch (PAB) Account Managers support the development of communications plans, products and activities in support of CRA priorities. PAB works to ensure a coordinated external and internal communications planning environment.

PAB Account Managers perform the following functions:

• Provide a link to the issues management network;
• Work with media relations in the timely delivery of their activities, including proactive/reactive (issues management) activities;
• Engage and collaborate with other government departments stakeholders, and partner organizations;
• Collaborate and provide direction involving Regions and Programs;
• Ensure work and resources are linked to priorities; and,
• Support the integration of internal communications into external communications plans (as required).

All the Account Managers ensure that work is done in collaboration with the following centres of expertise: